THE MATRIX: Total Information Awareness Reloaded

THE MATRIX: Total Information Awareness Reloaded New Documents Obtained by ACLU Raise Troubling Questions About Matrix Program ACLU Issue Brief #2 May 20, 2004 Since the inception of the Multistate Anti-Terrorism Information Exchange (MATRIX) program, the ACLU and others have charged that it is an effort to recreate the discredited Total Information Awareness (TIA) datamining program at the state level. New documents obtained in recent weeks by the ACLU make clear that these fears about the Matrix are well founded. 1 Through more than 20 state and federal Freedom of Information Act requests, the ACLU has gathered far more detail about the program than has ever been released to the public and revealed the ways that official statements by program officials have been misleading. Among the findings in the latest batch of documents obtained by the ACLU: New details about the role of data mining in the program publicly denied by Matrix officials including something called High Terrorist Factor scores. The company that runs Matrix provided the authorities with a list of 120,000 names of individuals who scored highly on this High Terrorist Factor analysis. The Department of Homeland Security not only financed the Matrix program, as has previously been reported, but actually assumed managerial control. Florida Governor Jeb Bush has personally taken a lead role in selling the program. Vice President Cheney was given a personal briefing on and plea for support for the Matrix program by Governor Bush in January 2003. The current findings are based on documents obtained from Florida, Georgia, New York, Utah, and the U.S. Department of Justice. Data Mining in Action Despite denials and attempts to downplay the role of data mining in the Matrix program, the new documents reveal that data mining also known by the euphemism factual data analysis has been a central part of the program. Data mining is controversial because it involves not the attempt to learn more facts about known suspects, but mass scrutiny of the lives and activities of innocent people (through the information signatures they leave behind in various databases) to see whether each of them shows any signs of being a terrorist or other criminal. This constitutes a massive invasion of privacy, and a violation of the core democratic principle that the government not be permitted to violate a person s privacy unless it has reason to believe that he or she is involved in wrongdoing. 1 THE MATRIX: ACLU Issue Brief #2

Documents previously obtained by the ACLU already contained numerous references to data mining, but the new documents offer stunning detail about how that data mining has been conducted. The Terrorism Quotient A January 2003 slide presentation by the company that created the Matrix, Seisint Inc. of Boca Raton, Florida, reveals that Seisint created a terrorism quotient that purported to measure the likelihood that individuals in the company s databases were terrorists. The company calls this measure a High Terrorist Factor (HTF) score. 2 According to the presentation, the company s aim was to use the power of the supercomputer to analyze massive amounts of data in order to identify potential terrorists in the general population. To do so, Seisint created the terrorism quotient, which was based on data described in the presentation as follows: Age & Gender What They Did With Their Drivers License Either Pilots or Associations to Pilots Proximity to Dirty Addresses/ Phone Numbers Investigational Data How They Shipped; How They Received Social Security Number Anomalies Credit History Ethnicity 3 When enough insignificant data is gathered and analyzed, a Seisint slide declared, IT BECOMES SIGNIFICANT. 4 120,000 Terrorists? For some individuals in the United States, the data gathered by Seisint may have become significant indeed. Stunningly, Seisint in its presentation bragged that: The INS, FBI, USSS and FDLE were provided a list of 120,000 names with the highest HTF (High Terrorist Factor) scores. We don t know what actions were taken by the INS, FBI, Secret Service, or Florida Department of Law Enforcement based on this list, except for Seisint s claim that it led to several arrests within one week, and Scores of other arrests using the HTF. The revelation about Seisint s decision to create a list of Americans or residents that it deemed suspicious raises numerous questions that must be answered, most importantly: How many of those arrests led to convictions, and how many turned out to be of innocent individuals? What kinds of privacy invasions, investigations, or other ill effects may have accrued to the overwhelming number of innocent individuals named in this list who were not arrested? 2 THE MATRIX: ACLU Issue Brief #2

In particular, given the ease with which the government is able to find technical immigration violations in those it decides to target, and the large number of arbitrary detentions and deportations of immigrants that have been carried out by the Bush Administration since 9/11, how many immigrants were detained or deported based on Seisint s list? Has this list been used to justify search warrants, FISA orders, or other forms of surveillance or invasion of privacy? Has this list been retained by the law enforcement agencies to which it was given? What future uses might those agencies make of the list? Has inclusion on this list been noted in permanent files maintained about any individuals? What role did ethnicity play in the creation of this list? Exactly which ethnicities were given higher HTF scores? Did members of other ethnic groups have their scores lowered? And how was ethnicity defined? Was religion part of the definition? If the law enforcement community expects the public to accept radically invasive techniques such as data mining, it must release the answers to these questions immediately so that the public can have a full and clear understanding of just what is involved. Terrorism Quotient a Routine Application In addition to the list of 120,000 names provided to law enforcement, and an earlier list of 419 names the company reports having provided in 2001, Seisint in May 2003 also made clear that data mining and use of the terrorism quotient is to be an everyday and routine part of the functioning of the program. In a May 2003 document, Matrix officials wrote that Seisint had: The proven and tested capability to integrate public data sources and law enforcement sensitive data into a single searchable repository, including mapping data relationships between multiple sources, providing a common search interface, establishing consistent entity relationships within data, and creating quick effective update procedures while applying the terrorism quotient in all cases. 5 Clearly, the Matrix goes far beyond anything that the police have ever routinely done outside of an actual criminal investigation. Yet it would be applied to innocent citizens on a mass scale. According to this document, Seisint s ability to consolidate seemingly insignificant or unrelated bits of data into potential solution sets through innovative search algorithms contained in the terrorism quotient was cited as the justification for why the contract to run the Matrix had to be awarded to a private company without any public bidding. It is hard to imagine how Matrix officials can honestly claim that data mining is not a central part of the program. Fighting The Last War One of the problems with the use of data mining as a means of identifying terrorists is that the number of terrorist attacks has not been large enough to compile a valid statistical profile that can be used as the basis for analysis. The result is that abstract profiles of terrorists must be based on the behavior and characteristics of prior terrorist attacks, which in all probability will not be identical to future terrorist attacks. Like generals fighting the last war, anti-terrorist data miners are 3 THE MATRIX: ACLU Issue Brief #2

inevitably trapped by the past. If they were, in fact, to take account of the full range of potential future attacks, then their criteria would flag so many potential suspects that they would be rendered useless (although 120,000 may already be enough to do so). According to a description of the program s origins provided to the Justice Department, this is just what the Matrix has done: built a model around the 9/11 hijackers, which they then fine-tuned in an ad hoc manner according to its ability to identify the behavior of the hijackers. According to the document, Seisint decided to enhance its commercial analytical tools to develop a terrorism quotient based on knowledge gathered about the 19 hijackers. Developing this quotient required identifying a set of criteria that accurately singled out characteristics related to the perpetrators of September 11 and other terrorist events, Seisint said. Not surprisingly, after a period of testing and refining, the company s terrorism quotient methodology was able to correctly identify five of the known hijackers in records provided by the state of Florida. 6 Even if this system had been in place before 9/11, it never would have stopped the plot because nothing like it had been done before and it is a classic strategy of terrorists is to change tactics. Data Mining Denials Matrix officials have consistently denied that the program contains data mining, or claimed that its use has been discontinued. There are numerous reasons to be skeptical of this claim, however: Although there is bountiful documentary evidence indicating the centrality of data mining to the program, there is not one document that references any curbing or termination of data mining. In a program where everything appears to have been meticulously recorded, it would be surprising that such a major decision would leave no documentary traces. Why would they not inform participating states of such a decision? On the other hand, a Matrix Progress Report furnished to the Justice Department in January 2004 still contained descriptions of the program s factual data analysis objectives, as did a document on Sole Source Criteria that was still being sent to the states the same month. 7 Even if the terrorism quotient was, in fact, discontinued, it could still be reinstated at any time and probably would be, once public scrutiny and criticism died down. Following the Money to Washington Until now, the Matrix has been understood as a state-run program operating with financial support from the federal government. New documents obtained from the New York State Police, however, reveal that the federal government has been far more than a funder of this program it has been a partner, and a senior one at that. In July 2003 the Department of Homeland Security s Office of Domestic Preparedness (ODP) approved a grant request for $8 million for the operation and expansion of the Matrix. However, ODP informed Matrix officials, the agency has elected to enter into a Cooperative Agreement (rather than a grant). 4 THE MATRIX: ACLU Issue Brief #2

Under the Cooperative Agreement, DHS would: provide the services of a ODP Project Manager as a single point of contact for administration of the Cooperative Agreement and maintain managerial oversight and control of the activities, including redirection of the MATRIX activities or resources to ensure that activities or resources support the mission and goals of ODP in an efficient and cost effective manner. 8 The agreement also gave DHS the power to Review and approve/disapprove the plan and activities for delivering services and any informational materials developed by the recipient pertaining to the project. In exchange for $8 million in funding, in other words, DHS assumed direct administrative control over the Matrix. And, since that time, DHS has played an increasingly large role in the program, convening a meeting of all existing and potential members of the program in order to discuss the program s future. 9 Following Governor Jeb Bush to Washington: Pitching Matrix to the Vice President Matrix has also been the subject of intense interest at the highest levels of the Bush Administration. In January 2003, Florida Governor Jeb Bush, along with the Commissioner of the Florida Department of Law Enforcement (FDLE) briefed Vice President Dick Cheney on the Matrix. They highlighted how the program could be accessed by local, state and federal law enforcement and the anti-terrorism potential of factual data analysis (data mining). According to a document entitled Briefing Points for the Vice President of the United States, Governor Bush was seeking Cheney s support for federal funding, noting that to implement this project across all 13 states that were then participating, would cost approximately $2 million per state. 10 Matrix officials have also briefed the current Secretary of the Department of Homeland Security, Tom Ridge, and Robert Mueller, Director of the FBI. 11 In addition, Governor Bush appears to have taken an active personal role in selling the Matrix program to other states; in April 2003 he apparently hosted a conference call and Internet video demonstration of the program for governors and staff of other participating states. 12 Conclusion The scope of the Matrix has always been troubling. The system contains tens of billions of records, and at its inception claimed as members 13 states home to more than 50 percent of the U.S. population. 13 While two-thirds of the participating states have since dropped out of the program, five states Connecticut, Florida, Michigan, Ohio and Pennsylvania continue to remain part of the Matrix, representing 18.7% of the U.S. population. Worse, now that the structure of the system is in place, it is likely that unless it is shut down outright, it will be revived at a later time once the public spotlight has moved elsewhere. 5 THE MATRIX: ACLU Issue Brief #2

The Matrix program has always been extraordinarily secretive. It is a program that carries enormous significance for the privacy of Americans, and has the potential to redraw the relationship between individuals and the government in our democratic society yet it was created without any input from the public or legislators, operates without any meaningful oversight or control, and its operators have consistently refused to describe the sources of information, especially the private-sector sources, that the system draws upon. And Matrix officials have not only refused to provide details about the program s data mining functions, they have consistently denied that such functions even exist. It is now clear that the program operates much differently than its creators would have us believe. Federal control of the program is much greater than previously disclosed; supercomputers are being used not just to compile information but analyze it as well. All of this raises troubling questions about how Matrix is being used and what impact is having on the lives of innocent Americans. Because of its high cost, Matrix is losing support in the states. The time has come for Americans to demand that program be ended once and for all it and that all of the details of its operation be made public so that the experience of this program can inform the larger public debate about data mining and its dangers. Endnotes 1 For descriptions of previous ACLU findings on Matrix see The MATRIX: Total Information Awareness Reloaded, ACLU Issues Brief, October 2003; online at http://www.aclu.org/privacy/privacy.cfm?id=14254&c=130. 2 Seisint, MATRIX: First Responder Support, slide presentation, January 24, 2004; online at http://www.aclu.org/privacy/privacy.cfm?id=15814&c=130. This document was obtained from an oversight committee created by the Governor of the State of Utah to determine if the state would continue to participate in the Matrix program. Utah subsequently withdrew from the Matrix. 3 Ibid. 4 Ibid. Emphasis in original. 5 Institute for Intergovernmental Research, Sole Source Criteria for the Multistate Anti-Terrorism Information Exchange (MATRIX) Project, document submitted to the Justice Department s Bureau of Justice Assistance, May 2003; online at http://www.aclu.org/privacy/privacy.cfm?id=15811&c=130. Emphasis added. 6 Ibid. 7 Institute for Intergovernmental Research, Progress Report: July-December 2003, January 31, 2003; online at http://www.aclu.org/privacy/privacy.cfm?id=15825&c=130. IRR, Sole Source Criteria. 8 DHS, Office of Domestic Preparedness, Cooperative Agreement, July 25, 2003; online at http://www.aclu.org/privacy/privacy.cfm?id=15816&c=130. Emphasis added. 9 Minutes of the Matrix Board of Directors Conference Call, March 18, 2004; online at http://www.aclu.org/privacy/privacy.cfm?id=15823&c=130. 10 Briefing Points for the Vice President of the United States, January 2003; online at http://www.aclu.org/privacy/privacy.cfm?id=15821&c=130. 11 MATRIX Board of Directors Meeting Minutes, Feb. 6, 2003; online at http://www.aclu.org/privacy/privacy.cfm?id=14900&c=130. 12 Letter from Governor Jeb Bush to Governor Mike Foster, March 19, 2003; memorandum from Vernon M. Keenan, Georgia Bureau of Investigation, to Jim Lientz and William W. Hitchens, Jr., Re: Matrix, April 18, 2003; both online at http://www.aclu.org/privacy/privacy.cfm?id=15818&c=130. 13 Briefing Points for the Vice President. 6 THE MATRIX: ACLU Issue Brief #2